Overview

overview

10

Static

static

10

Test.ps1

windows10-2004-x64

8

Test.ps1

windows10-ltsc 2021-x64

8

Test.ps1

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Test.ps1

  • Size

    1KB

  • Sample

    250213-2pmygaxlgz

  • MD5

    90f005af971f731a22a09ee0985446d3

  • SHA1

    ca1e851c896b62fffa7d675ca7920d630a71413e

  • SHA256

    73f7b1dae75549f16ea9665fe0e7cf462735e5a5fd0ede8be05885113d13deda

  • SHA512

    9828e013ffb952078b4a3dd6f77c13818bd82db8d800633efa457f83c620e827485f79ab4f994b673b75dcf34f87fdbfc53e881c2287a29fd7018a87d9ce713b

Score
10/10
vidarcredential_accessdiscoveryexecutionspywarestealer

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://azsolver.com/files/main.exe

Extracted

Family

vidar

C2

https://t.me/b4cha00

https://steamcommunity.com/profiles/76561199825403037
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:137.0) Gecko/20100101 Firefox/137.0

Targets

    • Target

      Test.ps1

    • Size

      1KB

    • MD5

      90f005af971f731a22a09ee0985446d3

    • SHA1

      ca1e851c896b62fffa7d675ca7920d630a71413e

    • SHA256

      73f7b1dae75549f16ea9665fe0e7cf462735e5a5fd0ede8be05885113d13deda

    • SHA512

      9828e013ffb952078b4a3dd6f77c13818bd82db8d800633efa457f83c620e827485f79ab4f994b673b75dcf34f87fdbfc53e881c2287a29fd7018a87d9ce713b

    Score
    10/10
    discoveryexecutionvidarcredential_accessspywarestealer

    • Detect Vidar Stealer

      stealer

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar family

      vidar

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

      credential_accessstealer

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Modify Authentication Process

1
T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

1
T1556

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Modify Authentication Process

1
T1556

Steal Web Session Cookie

1
T1539

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

3
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks